name: ESCU Default Configuration Correlation
id: 36ba498c-46e8-4b62-8bde-67e984a40fb4
date: '2021-12-21'
author: Patrick Bareiss
description: This configuration file applies to all detections of type Correlation.
  These correlations will generate Notable Events.
scheduling:
  cron_schedule: 0 * * * *
  earliest_time: -70m@m
  latest_time: -10m@m
  schedule_window: auto
alert_action:
  notable:
    rule_description: '%description%'
    rule_title: '%name%'
    nes_fields: 
    - user
    - dest
tags:
  type: 'Correlation'